In my opinion the best way to do this would be to run a 3rd party anti-virus/spam gateway in front of your Zimbra server and then pass incoming email through this gateway.

Theoretically though, since Zimbra uses amavisd, which supports other anti-virus software, you could install one of these supported anti-virus software packages on the Zimbra server and then configure the Zimbra amavisd software to use it. However, this would be outside the standard Zimbra install so troubleshooting and getting help would be made more difficult.